Become comfortable with basic Cisco IOS Software and Catalyst 3550 security features with an introduction to password management, disabling unnecessary services, setting up secure HTTP and NTP services, and SSH.

Routers and Catalyst 3550 series switches are the predominant hardware
components used in the CCIE Security lab exam. This chapter covers some of the
basic security features that are available in Cisco IOS Software for routers and
3550 switches. The chapter is divided into two major parts:

Cisco IOS Software security

Catalyst 3550 security

The first part deals with the introduction and configuration of some of the
basic router security features. The second part discusses configuration of basic
security features on the 3550 switches. Although many more basic security
features are available for routers and switches than those included in this
chapter, here you concentrate on those features that are most likely to appear
on the CCIE Security exam.

Cisco IOS Software Security

Routers are an important part of any network, and successful implementation
of Cisco IOS Software security features increases router efficiency and, by
association, the efficiency of the entire network. Cisco IOS Software
includes a number of useful services. Unfortunately, many of them present a
security concern. In this chapter, you find a short explanation of some of these
services, their functionality, and how they can be misused by an attacker. Then
you learn how to use the various Cisco IOS Software basic mechanisms that are
designed to protect information.

Network Time Protocol Security

Network Time Protocol (NTP) is used for automatic time synchronization. Cisco
networks use NTP to make timekeeping accurate and coordinated across the board.
The use of NTP is highly recommended for security because having accurate time
is important for intrusion and forensic analysis. NTP is typically deployed in a
hierarchical fashion. All routers on the network should be made a part of the
hierarchy, if possible. If an NTP hierarchy is not feasible, you should disable
NTP. To prevent NTP from traversing the router altogether, apply an access list
to an appropriate interface.

HTTP Server Security

To enable configuration and management of network devices remotely, Cisco IOS
Software offers web-based Hypertext Transfer Protocol (HTTP) administration.
Though the web-access features are quite common on Cisco routers, they
facilitate not only a mechanism for monitoring and configuring but also for
attacking a router. The HTTP traffic needs to be protected by securing the
communication between the HTTP client and the HTTP server. Several security
technologies are available for this task (HTTPS, SSL, SSH, and IPSec) which are
discussed throughout this book. Of course, if web-based remote administration is
not necessary, you should disable this feature.

Password Management

To control who can access the router command prompt, you can set various
passwords for various access points to the router. You can configure the
passwords for local console access or remote access via Telnet. This is done to
prevent unauthorized changes to a router's behavior and also to protect
information that can be learned by looking at the network statistics on a
router. This chapter's password discussion concentrates on three types of
passwords:

Enable password

Per-user passwords and privilege levels

Line passwords

Enable Password

Enable password secures the privileged EXEC mode of a router. At this level,
an administrator can view and change anything on the router. That is why such
access needs to be closely guarded.

Privilege Levels

Additional controls are available in Cisco IOS Software to limit
administrative access with various privilege levels. You can define different
privilege levels for different passwords that permit a certain subset of
commands to be configured by a user. Once the password is entered, the user is
able to operate at the corresponding level. Cisco IOS Software supports a total
of 16 privilege levels, ranging from 0 to 15. The default levels are 1 and 15.
Level 1 is basic (or nonprivileged), and 15 is the privileged EXEC mode that was
discussed in the preceding section.

Line Passwords

For remote administration, you can access Cisco routers via Telnet. Telnet
occurs over virtual terminal lines (vty). Most Cisco IOS Software versions have
five virtual terminals0 through 4that support five simultaneous
Telnet sessions. You should explicitly configure all the virtual terminals for
security purposes. No password is configured on vty ports by default to deny all
attempts to log in to a router remotely.

Access Lists

Cisco IOS Software uses access lists, also known as Access Control
Lists (ACLs), as security filters to permit or deny specific traffic from
entering or exiting parts of the network. Access lists are used heavily on Cisco
routers for restricting access to a router's services and for filtering
traffic passing through the router. The router looks at each packet and
determines whether to forward or drop the packet, based on the conditions that
are specified in the access lists.

Access lists can include the source and destination addresses of the traffic,
the protocol type, and so on. Access lists contain a list of statements that are
arranged in sequential order that establishes the matching criteria. Each packet
is checked against the list in the same order that the statements are
positioned. When a match is found, the router processes the packet accordingly
and does not go through the remainder of the statements. Therefore, you need to
call out specific conditions before the more general ones. For more on access
lists, refer to Chapter 16, "Access Control Lists."

Secure Shell

Secure Shell (SSH) service is a newer Cisco IOS Software feature that is
intended for use in secure remote administration. To create a secure link
between a client and a server, SSH uses Rivest, Shamir, and Adelman (RSA) public
key cryptography. Therefore, the communication between the administrator's
host and the router is encrypted. SSH is also used to prevent various kinds of
network attacks. Currently, Cisco implements only version 1 of SSH, but remember
to check for future updates.

NOTE

The SSH client has been available since the Cisco IOS Software 12.1.3.T
release.